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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 04 June 2009 . 
2a )□ This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-53 is/are pending in the application. 

4a) Of the above claim(s) 1-50 is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 51-53 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Election/Restrictions 

1 . Applicant's election without traverse of Claims 51-53 in the reply filed on 6/4/09 is 
acknowledged. 

Claim Rejections - 35 USC § 112 

2. The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

3. Claims 5 1 and 52 arc rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply 
with the enablement requirement. The claim(s) contains subject matter which was not described 
in the specification in such a way as to enable one skilled in the art to which it pertains, or with 
which it is most nearly connected, to make and/or use the invention. Claim 5 1 recites the steps of 
qualifying the treat type and quantifying the threat type, first in the specification, the applicant 
claims this as being one step, a step of qualifying and quantifying the threat type, therefore it is 
unclear what steps are related to qualifying and what steps are related to quantifying in the 
specification. Second, in the specification, page 19 paragraph 0079 discloses the qualifying and 
quantifying step by determining a dollar loss value per instance and cost such as shielding a 
customer from SPAM, loss of productivity and the cost to deal with the SPAM is considered. 
The specification discloses what things are considered when qualifying and quantifying the 
threat, however never discloses how to determine a dollar loss value, how to determine the loss 
of productivity, and the cost to deal with the SPAM or shielding a customer from SPAM. 
Furthermore never disclosed how to use those numbers to determine a dollar loss value per 
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instance. Therefore, one of ordinary skill in the art would not know how to qualify and quantify 
a threat source. 



Claim Rejections - 35 USC §101 

1. 35 U.S.C. 101 reads as follows: 

a. Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 

matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

2. Claims 51-53 are rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non- statutory subject matter. 

3. The first step in determining whether a claim recites patent eligible subject matter is to 
determine whether the claim falls within one of the four statutory categories of invention recited 
in 35 USC 101 : process, machine, manufacture and composition of matter. The latter three 
categories define "things" or "products", while a "process" consists of a series of steps or acts to 
be performed. 

4. In Claims 51-53, the claims are drawn to a method. For purposes of 101 , a "process" has 
been given a specialized, limited meaning by the courts. Based on In re Bilski (Federal Circuit 
2007-1 130), the court outlined a test used to determine whether a method satisfies 35 USC 101, 
is a machine -or-transformation test. In re Bilski states "the machine-or-transformtion test is a 
two-branched inquiry; an applicant may show that a process claim satisfies 101 either by 
showing that his claim is tied to a particular machine, or by showing that his claim transforms an 
article. See Benson, 409 U.S. at 70. Certain considerations are applicable to analysis under either 
branch. First as illustrated by Benson and discussed below, the use of a specific machine or 
transformation of an article must impose meaningful limits on the claim's scope to impart patent- 
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eligibility. See Benson, 409 U.S. at 71-72. Second, the involvement of the machine or 
transformation in the claimed process must not merely be insignifigant extra-solution activity. 
See Flook, 437 US at 590. Claims 51-53 are drawn to a method for enabling action against a 
threat source. The claimed steps of receiving, preserving, parsing, correlating, collecting, cross- 
referencing and storing are done involving emails on a computer, however can be done by a 
person sitting at a computer and as claimed, does not positively recite that the steps are computer 
implemented. It is not enough to be done utilizing a computer, but it must be done by the 
computer. Therefore the claims do not pass the machinc-or-transformation test and are hence not 
directed to statutory subject matter. 

Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

6. Claims 51-53 are rejected under 35 U.S.C. 102(e) as being anticipated by Judge (US 
2007/0300286). 

7. With respect to Claim 5 1 : Judge discloses the use of a method for enabling action against 
a threat source (see abstract) comprising: 
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b. 



Receiving evidence relating the a plurality of unsolicited emails through a 



proprietary account and through a referral from a victim (Paragraphs 0044, 0046 and 



0192); 



c. 



Preserving the evidence in a secure evidence repository (Paragraph 0048 and 



0193); 



d. Parsing the evidence to extract data relating to threat types, sources, intermediate 
parties and beneficiaries, thereby producing parsed evidence (Paragraph 0194); 

e. Correlating the parsed evidence to produce common threat types, sources, 
intermediaries, and beneficiaries relating to the unsolicited emails (Paragraph 0195); 



correlating and Cross-referencing the information and the common threat types, sources, 
intermediaries and beneficiaries (Paragraphs 0196-0201); and 
g. Storing a result of the cross-referencing (Paragraph 0206). 

8. With respect to Claim 52: Judge discloses an Action engine, which qualifies the 
threat/anomaly and assigns a value to determine if the anomaly exceeds the threshold value (See 
Paragraphs 0196-0198 and 0210-0224). 

9. With respect to Claim 53: Judge discloses the use of an action engine with an alert engine 
which outputs a signal, which may trigger an alert message or notification of an action to be 
performed (Paragraphs 0203-0205) and queries this information for the threat from an anomaly 
action table, which the examiner considers to be a form of intelligence (Paragraphs 0221-0222). 



f. 



Collecting information from both open and closed sources based on the 
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Conclusion 

10. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Graham et al. (7,467,410) discloses the use of identifying network misuse, Aronson et 
al. (6654,787) discloses the use of filtering email messages on behalf of a client, and Trcka et al. 
(6,453,345) discloses the use of network surveillance to evaluate network attacks. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JAMISUE A. PLUCINSKI whose telephone number is (571)272- 
681 1. The examiner can normally be reached on M-Th (5:30 - 4:00). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Weiss can be reached on (571) 272-6812. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Jamisue A. Plucinski/ 

Primary Examiner, Art Unit 3629 



